trafficjam icon indicating copy to clipboard operation
trafficjam copied to clipboard

Accept traffics to the reverse proxy

Open snwnde opened this issue 7 months ago • 4 comments

Per the current principal of operation, traffics within the subnet are dropped unless they are already established or from the whitelisted containers (most likely just the reverse proxy container).

However, there are legitimate cases for containers to initiate connection to the reverse proxy as well. For example, an SSO integration would need to have access to the auth service via the reverse proxy.

With the current implementation, one can either 1. add the containers to the whitelist or 2. turn on ALLOW_HOST_TRAFFIC and make the connection via host port, but both would have a larger attack surface than allowing some containers to initiate the connection to the reverse proxy within the subnet.

snwnde avatar Jun 07 '25 09:06 snwnde